function StreamContextFactory::getTlsDefaults

Parameters

mixed[] $options:

Return value

mixed[]

2 calls to StreamContextFactory::getTlsDefaults()

HttpDownloader::__construct in vendor/composer/composer/src/Composer/Util/HttpDownloader.php

RemoteFilesystem::__construct in vendor/composer/composer/src/Composer/Util/RemoteFilesystem.php

Constructor.

File

vendor/composer/composer/src/Composer/Util/StreamContextFactory.php, line 138

Class

StreamContextFactory

Allows the creation of a basic context supporting http proxy

Namespace

Composer\Util

Code

public static function getTlsDefaults(array $options, ?LoggerInterface $logger = null) : array {
    $ciphers = implode(':', [
        'ECDHE-RSA-AES128-GCM-SHA256',
        'ECDHE-ECDSA-AES128-GCM-SHA256',
        'ECDHE-RSA-AES256-GCM-SHA384',
        'ECDHE-ECDSA-AES256-GCM-SHA384',
        'DHE-RSA-AES128-GCM-SHA256',
        'DHE-DSS-AES128-GCM-SHA256',
        'kEDH+AESGCM',
        'ECDHE-RSA-AES128-SHA256',
        'ECDHE-ECDSA-AES128-SHA256',
        'ECDHE-RSA-AES128-SHA',
        'ECDHE-ECDSA-AES128-SHA',
        'ECDHE-RSA-AES256-SHA384',
        'ECDHE-ECDSA-AES256-SHA384',
        'ECDHE-RSA-AES256-SHA',
        'ECDHE-ECDSA-AES256-SHA',
        'DHE-RSA-AES128-SHA256',
        'DHE-RSA-AES128-SHA',
        'DHE-DSS-AES128-SHA256',
        'DHE-RSA-AES256-SHA256',
        'DHE-DSS-AES256-SHA',
        'DHE-RSA-AES256-SHA',
        'AES128-GCM-SHA256',
        'AES256-GCM-SHA384',
        'AES128-SHA256',
        'AES256-SHA256',
        'AES128-SHA',
        'AES256-SHA',
        'AES',
        'CAMELLIA',
        'DES-CBC3-SHA',
        '!aNULL',
        '!eNULL',
        '!EXPORT',
        '!DES',
        '!RC4',
        '!MD5',
        '!PSK',
        '!aECDH',
        '!EDH-DSS-DES-CBC3-SHA',
        '!EDH-RSA-DES-CBC3-SHA',
        '!KRB5-DES-CBC3-SHA',
    ]);
    
    /**
     * CN_match and SNI_server_name are only known once a URL is passed.
     * They will be set in the getOptionsForUrl() method which receives a URL.
     *
     * cafile or capath can be overridden by passing in those options to constructor.
     */
    $defaults = [
        'ssl' => [
            'ciphers' => $ciphers,
            'verify_peer' => true,
            'verify_depth' => 7,
            'SNI_enabled' => true,
            'capture_peer_cert' => true,
        ],
    ];
    if (isset($options['ssl'])) {
        $defaults['ssl'] = array_replace_recursive($defaults['ssl'], $options['ssl']);
    }
    
    /**
     * Attempt to find a local cafile or throw an exception if none pre-set
     * The user may go download one if this occurs.
     */
    if (!isset($defaults['ssl']['cafile']) && !isset($defaults['ssl']['capath'])) {
        $result = CaBundle::getSystemCaRootBundlePath($logger);
        if (is_dir($result)) {
            $defaults['ssl']['capath'] = $result;
        }
        else {
            $defaults['ssl']['cafile'] = $result;
        }
    }
    if (isset($defaults['ssl']['cafile']) && (!Filesystem::isReadable($defaults['ssl']['cafile']) || !CaBundle::validateCaFile($defaults['ssl']['cafile'], $logger))) {
        throw new TransportException('The configured cafile was not valid or could not be read.');
    }
    if (isset($defaults['ssl']['capath']) && (!is_dir($defaults['ssl']['capath']) || !Filesystem::isReadable($defaults['ssl']['capath']))) {
        throw new TransportException('The configured capath was not valid or could not be read.');
    }
    
    /**
     * Disable TLS compression to prevent CRIME attacks where supported.
     */
    $defaults['ssl']['disable_compression'] = true;
    return $defaults;
}